Question

Hi
I want to create a WCF service that have login method, which is authenticating and giving user roles, and depending to that roles, allow or disallow user to call other service methods. Which is the best way to do that? Is there WCF standart mechanism to achieve this?
Thanks a lot!

Answer 1

Basically you don’t. Returning a ticket from a login method isn’t safe, what’s to stop an application editing it and sending a faked version with each subsequent request. Yes you could sign it, but then you’re sending something rather large.

Instead simply require a username/password combination each time, and use the standard authentication and authorization bits, and role based CAS to check and limit based on role.

WCF already provides everything needed to use message based security and require a username and password with each request – and that’s a standard SOAP function. Plug in an authentication provider (easy if you’re already using the ASP.NET membership functions), then plug in roles (again easy if you’re using the ASP.NET bits – otherwise roll your own

Once you have a role based principal you can use declarative permission demands

[PrincipalPermission(SecurityAction.Demand, Role = "Administrators")] 

on methods you want to protect, or even entire classes.